On 25-03-21, 17:16, Arnd Bergmann wrote:
> On Wed, Mar 24, 2021 at 8:33 AM Viresh Kumar <viresh.ku...@linaro.org> wrote:
> > +static void vi2c_handle_ctrl(VuDev *dev, int qidx)
> > +{
> > + VuVirtq *vq = vu_get_queue(dev, qidx);
> > + struct i2c_msg msg;
> > + struct virtio_i2c_out_hdr *out_hdr;
> > + struct virtio_i2c_in_hdr *in_hdr;
> > + bool fail_next = false;
> > + size_t len, in_hdr_len;
> > +
> > + for (;;) {
> > + VuVirtqElement *elem;
> > +
> > + elem = vu_queue_pop(dev, vq, sizeof(VuVirtqElement));
> > + if (!elem) {
> > + break;
> > + }
> > +
> > + g_debug("%s: got queue (in %d, out %d)", __func__, elem->in_num,
> > + elem->out_num);
> > +
> > + /* Validate size of out header */
> > + if (elem->out_sg[0].iov_len != sizeof(*out_hdr)) {
> > + g_warning("%s: Invalid out hdr %zu : %zu\n", __func__,
> > + elem->out_sg[0].iov_len, sizeof(*out_hdr));
> > + continue;
> > + }
> > +
> > + out_hdr = elem->out_sg[0].iov_base;
> > +
> > + /* Bit 0 is reserved in virtio spec */
> > + msg.addr = out_hdr->addr >> 1;
> > +
> > + /* Read Operation */
> > + if (elem->out_num == 1 && elem->in_num == 2) {
> > + len = elem->in_sg[0].iov_len;
> > + if (!len) {
> > + g_warning("%s: Read buffer length can't be zero\n",
> > __func__);
> > + continue;
> > + }
>
>
> It looks like you are not handling endianness conversion here. As far as I
> can tell, the protocol requires little-endian data, but the code might
> run on a big-endian CPU.
I hope this is all we are required to do here, right ?
@@ -442,7 +421,7 @@ static void vi2c_handle_ctrl(VuDev *dev, int qidx)
out_hdr = elem->out_sg[0].iov_base;
/* Bit 0 is reserved in virtio spec */
- msg.addr = out_hdr->addr >> 1;
+ msg.addr = le16toh(out_hdr->addr) >> 1;
/* Read Operation */
if (elem->out_num == 1 && elem->in_num == 2) {
@@ -489,7 +468,7 @@ static void vi2c_handle_ctrl(VuDev *dev, int qidx)
in_hdr->status = fail_next ? VIRTIO_I2C_MSG_ERR : vi2c_xfer(dev, &msg);
if (in_hdr->status == VIRTIO_I2C_MSG_ERR) {
/* We need to fail remaining transfers as well */
- fail_next = out_hdr->flags & VIRTIO_I2C_FLAGS_FAIL_NEXT;
+ fail_next = le32toh(out_hdr->flags) & VIRTIO_I2C_FLAGS_FAIL_NEXT;
}
These are the only fields we are passing apart from buf, which goes
directly to the client device.
--
viresh
